HttpContext.User always null in any controller

Question

i get always null as User in any controller

var usr = User as ClaimsPrincipal;

i've configired my app in this way:

var builder = WebApplication.CreateBuilder(args);

ConfigurationManager configuration = builder.Configuration;
builder.Services.AddDbContext<CustomIdentityDbContext>(options =>
{
    options.UseSqlServer(configuration.GetConnectionString("SqlServerConnection")).EnableSensitiveDataLogging();

   }
);

//config my custom identity
builder.Services.AddIdentity<WSA_UTENTE, WSA_RUOLI>(options =>
{
    options.SignIn.RequireConfirmedAccount = true;
})
.AddEntityFrameworkStores<CustomIdentityDbContext>()
.AddDefaultTokenProviders();


//add jwt autentication middleware
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = builder.Configuration["Jwt:Issuer"],
        ValidAudience = builder.Configuration["Jwt:Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
    };
});

then i'm able to generate a token

private JwtSecurityToken GetToken(IEnumerable<Claim> authClaims)
        {
            var authSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Jwt:Key"]));

            var token = new JwtSecurityToken(
                issuer: _configuration["Jwt:ValidIssuer"],
                audience: _configuration["Jwt:ValidAudience"],
                expires: DateTime.Now.AddMinutes(String.IsNullOrEmpty(_configuration["Jwt:AccessTokenLifetime"]) ? int.Parse(_configuration["Jwt:AccessTokenLifetime"]) : 525600),
                claims: authClaims,
                signingCredentials: new SigningCredentials(authSigningKey, SecurityAlgorithms.HmacSha256)
                );

            return token;
        }

between the prominent claims:

"sub: 8001ac54-12c0-4d18-f5a7-08db0445001d"
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name: myusername"

whenever i call any controller var usr = User as ClaimsPrincipal; is always null

do i need to do something like HttpContext.SignInAsync to populate the HttpContext.Useror the jwt middleware do all the dirty job automatically?

Answer 1

EDIT: don't forget to add builder.Services.AddHttpContextAccessor();, app.UseAuthentication(); and app.UseAuthorization(); in Program.cs

There may be an issue in how you store and retrieve the JWT.

I store mine as a string in a cookie and then retrieve the cookie value from each request as a JWT.

You can also store it in LocalStorage, but you will have to send the JWT as a bearer token in the authorization header for each request to the server.

// saving JWT in a cookie in Razor page controller
string jwtSecurityTokenHandler = new JwtSecurityTokenHandler.WriteToken(GetToken(authClaims));

Response.Cookies.Append("jwtCookieName", jwtSecurityTokenHandler, new CookieOptions
{
    HttpOnly = true,
    IsEssential = true,
    Secure = true,
    SameSite = SameSiteMode.Strict,

    // need to specify an expiry date for persistency
    // otherwise cookie will default to Session and will be cleared on browser closed
    Expires = new DateTimeOffset(DateTime.Now).AddDays(7)
});

---

// get cookie from HttpContext
public class UserAuth
{
    private readonly IHttpContextAccessor? _httpContextAccessor; // builder.Services.AddHttpContextAccessor(); --> add default implementation of HttpContextAccessor in Program.cs to access http context in a service class
    public UserAuth(IHttpContextAccessor httpContextAccessor) => _httpContextAccessor = httpContextAccessor;

    // use it like this: new UserAuth().GetClaimsFromContext();
    public IEnumerable<Claim> GetClaimsFromContext()
    {
        if (_httpContextAccessor is null || _httpContextAccessor.HttpContext is null)
            return Enumerable.Empty<Claim>();

        if (_httpContextAccessor.HttpContext.User.Identity is not ClaimsIdentity claimsIdentity || claimsIdentity.Claims is null || !claimsIdentity.Claims.Any())
            return Enumerable.Empty<Claim>();

        IEnumerable<Claim> listUserClaims = claimsIdentity.Claims ?? Enumerable.Empty<Claim>();
    }
}

---

// JWT configuration in Program.cs
options.SaveToken = true;
options.TokenValidationParameters = new TokenValidationParameters {...};

// authenticate user using JWT stored in cookie
options.Events = new JwtBearerEvents
{
    OnMessageReceived = context =>
    {
        context.Token = context.Request.Cookies["jwtCookieName"];
        return Task.CompletedTask;
    }
};

---

Here is more ways to get a JWT from a cookie found by @user1269009

Ref. 1

Ref. 2